Security Headers Checker / Headers

Reporting-Endpoints: hear about CSP violations

Reporting-Endpoints names URLs the browser sends reports to; CSP's report-to directive picks one by name. Without it, you never hear about the attacks your policy blocks or the resources it breaks.

What to send

Reporting-Endpoints: csp="https://reports.example.com/csp"

Then add report-to csp to your Content-Security-Policy. The endpoint must accept POSTs of application/reports+json. Keep report-uri as well for older browsers. Our checker shows whether the reports are wired; the grade does not count it.

# server { } block (or a file included in every server block).
# "always" also sends the header on error and redirect responses.
add_header Reporting-Endpoints "csp=\"https://reports.example.com/csp\"" always;

Common mistakes

• report-to naming an endpoint that Reporting-Endpoints does not define: reports go nowhere.
• The old Report-To header (JSON): superseded, except for NEL.

Reporting-Endpoints on MDN